Data Protection & Privacy
nrtoto is committed to handling your personal data with the highest standards of care, transparency, and security. This policy explains exactly what we collect, why we collect it, and how we protect it.
Our Privacy Commitments
Before reading the full policy, here is a summary of our six core privacy commitments to every nrtoto user.
Every data transmission between your device and nrtoto servers is protected by industry-standard 256-bit SSL/TLS encryption. Your credentials, payment details, and personal data are never transmitted in plain text.
nrtoto collects only the personal information that is strictly necessary to operate your account, process payments, comply with KYC requirements, and deliver a safe gaming experience. We do not collect surplus data.
nrtoto does not sell, lease, or trade your personal data to third-party advertisers, data brokers, or marketing agencies under any circumstances. Your data is yours, and it stays within the nrtoto ecosystem.
Access to personal data inside nrtoto is restricted to employees and contractors who have a direct operational need. All internal data access is logged, audited, and subject to regular review by our compliance team.
Consistent with applicable data protection law, you have the right to request deletion of your personal data at any time (subject to legal retention obligations). Requests are processed within 30 calendar days of verified submission.
In the unlikely event of a data breach affecting your personal information, nrtoto will notify you within 72 hours of discovery, explain the nature of the breach, and detail the steps we are taking to contain and remediate it.
For the purposes of this Privacy Policy, the following definitions apply:
When you register, verify your identity, or contact us, nrtoto collects the following categories of personal data:
| Category | Specific Data Points | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, KTP number (for Indonesian residents), passport number (for non-residents) | KYC verification, age restriction enforcement (21+), fraud prevention |
| Contact Data | Email address, mobile phone number, WhatsApp number (if provided) | Account communications, support, security alerts |
| Address Data | Residential address, city, province, postal code | KYC compliance, fraud prevention, jurisdictional eligibility |
| Financial Data | Bank account name and number (BCA, BRI, BNI, Mandiri), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) | Payment processing, withdrawal verification, AML compliance |
| Document Data | Copies of government-issued ID, utility bills, bank statements (KYC documents) | Identity verification, regulatory compliance |
When you visit or use the nrtoto Platform, we automatically collect certain technical data:
nrtoto may receive additional data about you from the following sources:
nrtoto processes your personal data under one or more of the following legal bases, depending on the nature of the processing activity:
The personal data we collect is used for the following purposes:
To create and maintain your nrtoto account, authenticate your identity at login, process your deposits and withdrawals via Indonesian payment channels (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), settle your wagers, and apply bonus credits to your account.
To fulfill KYC and AML regulatory obligations, verify that you are at least 21 years of age and a resident of an eligible jurisdiction, detect and prevent fraudulent activity including multi-accounting, bonus abuse, money laundering, and unauthorized account access.
To respond to your inquiries via live chat, email, or WhatsApp; to investigate and resolve disputes; to process account closure or self-exclusion requests; and to maintain records of support interactions for quality assurance and regulatory purposes.
To monitor betting patterns and account activity for indicators of problem gambling, to apply deposit limits, session time caps, and reality-check reminders that you have set, and to process and enforce self-exclusion requests in accordance with our Responsible Gaming policy.
To analyze aggregated, anonymized usage data to understand how users interact with the Platform, identify areas for improvement, optimize performance, and personalize your experience (for example, by displaying markets relevant to Indonesian football such as BRI Liga 1 and Timnas Indonesia fixtures).
To comply with applicable laws, court orders, regulatory requests, and law enforcement demands. nrtoto retains certain transaction and identity records for the minimum period required by applicable regulations, after which they are securely deleted.
Your personal data may be shared among nrtoto group entities where necessary to deliver Platform services, maintain security, or comply with regulatory requirements. All intra-group transfers are governed by binding data sharing agreements aligned with this Privacy Policy.
nrtoto engages authorized third-party service providers to assist in operating the Platform. These providers act as data processors and are permitted to use your data only to the extent necessary to deliver their contracted service. Categories include:
nrtoto may disclose your personal data to law enforcement, regulatory authorities, or courts when required by law, court order, or to protect the legal rights of nrtoto or its users. We will notify you of such disclosure to the extent permitted by applicable law.
In the event of a merger, acquisition, restructuring, or sale of all or part of nrtoto's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to this Privacy Policy that result from it, via email or prominent notice on the Platform.
nrtoto will never:
nrtoto retains your personal data only for as long as is necessary to fulfill the purposes set out in this Privacy Policy, or as required by applicable law. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account identity and KYC documents | 5 years after account closure | AML/KYC regulatory obligation |
| Transaction and betting history | 5 years from transaction date | Regulatory compliance and dispute resolution |
| Customer support records | 3 years from last interaction | Quality assurance and legal claims |
| Marketing consent records | Until consent is withdrawn plus 1 year | Evidence of lawful processing |
| Technical logs and access records | 12 months from creation | Security monitoring and fraud prevention |
| Self-exclusion records | Duration of exclusion plus 5 years | Responsible gaming and regulatory obligation |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our internal data disposal procedures.
As a user of nrtoto, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our support team via live chat or email at [email protected]. We will respond within 30 calendar days of receiving a verified request.
You have the right to request a copy of the personal data nrtoto holds about you, together with information about how that data is being processed, on what legal basis, and with whom it has been shared.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor corrections (e.g., phone number updates) may be made directly within your account settings; changes to identity documents require a new KYC submission.
You may request deletion of your personal data where: it is no longer necessary for the purpose it was collected; you withdraw consent and no other legal basis applies; or you object to processing and nrtoto has no overriding legitimate grounds. Erasure requests will be honored subject to our legal data retention obligations (see Section 6).
You may request that nrtoto restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection is being assessed. During restriction, nrtoto will continue to store your data but will not actively process it beyond storage.
Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, machine-readable format, and to request that it be transmitted to another controller where technically feasible.
You have the right to object to the processing of your personal data where that processing is based on our legitimate interests. nrtoto will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights. You may always opt out of marketing communications by contacting support.
Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw marketing consent, contact support via live chat or email.
Cookies are small text files placed on your device when you visit a website. They allow the site to recognize your device across sessions, remember your preferences, and collect usage information. nrtoto uses both first-party cookies (set directly by nrtoto) and third-party cookies (set by authorized service providers such as analytics platforms).
You may control cookie settings via your browser's privacy preferences. Please note that disabling essential cookies may prevent you from logging in or using core Platform features. For more granular control over non-essential cookies, contact our support team.
nrtoto implements a layered security architecture to protect your personal data from unauthorized access, alteration, disclosure, and destruction. Our security measures include:
While nrtoto takes all reasonable precautions, no system is entirely immune to security risk. You are encouraged to use a strong, unique password for your nrtoto account and to enable two-factor authentication.
nrtoto is strictly prohibited to persons under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If we become aware that an account belongs to a person under 21, we will immediately close the account, void all wagers, return any deposited funds (excluding winnings derived from underage play) to the source payment method, and delete the associated personal data.
If you are a parent or guardian and believe your child has registered an account on nrtoto, please contact us immediately at [email protected]. We will investigate and take action within 24 hours of receiving the report.
Some of nrtoto's service providers and infrastructure partners operate outside of Indonesia. Where personal data is transferred internationally, nrtoto ensures that adequate safeguards are in place, including:
nrtoto reserves the right to update or amend this Privacy Policy at any time. Material changes — those that significantly affect your rights or how we process your personal data — will be communicated via email notification to your registered address and/or a prominent notice on the Platform homepage, at least 14 days before the changes take effect.
Your continued use of the Platform following the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you disagree with any changes, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.
The date at the top of this page reflects the most recent revision. We recommend reviewing this policy periodically to stay informed of how nrtoto handles your personal data.
If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please reach out to the nrtoto privacy and compliance team:
For more information about how nrtoto handles responsible gaming concerns or for account-level restrictions, please visit our Responsible Gaming page. For general platform questions, our FAQ page covers the most common topics.
Our compliance team is available around the clock. Whether you want to exercise a data right, understand how your information is used, or simply learn more about nrtoto's security standards — we are here to help.